This is my manual method and it works without a hitch (after much trial and error, Googling and hints from this forum!

)
Add the following line to your cmdlines.txt just before you call RunOnceEx.cmd
CODE
".\IE6\ie6setup.exe /q:a /r:n"
This assumes that your ie6setup.exe file is in a sub-directory called IE6 in the root of $OEM$, i.e., the IE6 sub-directory is in the same directory as cmdlines.txt. I had previously downloaded only the Windows 2000 specific files for IE6 SP1 using the command line switches for ie6setup
CODE
ie6setup.exe /c:"ie6wzd.exe /d /s:""#E"
Copy the contents of the Windows Update Setup folder into your IE6 directory.
This will install IE6 during the T-13 point during the GUI install. The advantage of doing it this way is that on the next reboot during GUIRunOnce or if you use the RunOnceEx method to install your apps, your reboot has been taken care of and then you can install and post IE6 SP1 patches. Because IE6 requires a second reboot those patches need to be installed after a second reboot. Just autologon twice in your winnt.sif file. During the first autologon I add a RunOnceEx key to the registry that will call a batch file to run the hotfixes. So, this is added during the first logon:
CODE
SET KEY=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
REG ADD %KEY% /V TITLE /D "Installing Applications" /f
REG ADD %KEY%\10 /VE /D "Installing post-IE6 hotfixes" /f
REG ADD %KEY%\10 /V 1 /D "%systemdrive%\install\hotfixes\hotfixes.cmd" /f
These are keys are added using my cleanup.cmd batch file at the end of the first logon.
From what I've figured out these are the hotfixes you will need to add during the second login:
CODE
cmdow @ /HID
ECHO.
ECHO Installing Q329115 update resolves the Certificate Validation Flaw Could Enable Identity Spoofing
start /wait %systemdrive%\install\hotfixes\Q329115.EXE /Q /O /N /Z
ECHO.
ECHO Installing Q823559 Windows 2000 Security Patch (Buffer Overrun In HTML Converter Could Allow Code Execution)
start /wait %systemdrive%\install\hotfixes\Q823559.EXE /Q /O /N /Z
ECHO.
ECHO Installing Q832894 Cumulative Update for Internet Explorer 6 Service Pack 1
start /wait %systemdrive%\install\hotfixes\Q832894.EXE /Q:A /R:N
ECHO.
ECHO Installing Q831167 Update for Internet Explorer 6 Service Pack 1
start /wait %systemdrive%\install\hotfixes\Q831167.EXE /Q:A /R:N
ECHO.
ECHO Installing Q837009 Cumulative Security Update for Outlook Express Service Pack 1
start /wait %systemdrive%\install\hotfixes\Q837009.EXE /Q:A /R:N
shutdown.exe -r -f -t 60 -c "Windows 2000 will now restart in 1 minute..."
RD /S /Q %systemdrive%\drivers\
RD /S /Q %systemdrive%\install\
EXIT
It looks complicated at first, but if you follow the logic, then it makes quite a lot of sense. In summary this is what happens:
T-13: install IE6
First autologon/RunOnceEx: IE6 components registered; require reboot
Second autologon/RunOnceEx: IE6 hotfixes applied